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IN THE CLAIMS 

A listing of the claims of the present application are as follows: 

1 . (Currently Amended) A computer-based method for use in accordance with an event 
management system, the method comprising the steps of: 

automatically generating one or more event relationship networks from event data, wherein 
an event relationship network comprises a graphical representation wherein nodes representing 
events and links connecting correlated nodes; and 

utilizing the one or more generated event relationship networks to construct one or more 
correlation rules for use by a correlation engine in the event management system. 

2. (Original) The method of claim 1, further comprising the step of subjecting the one or 
more generated event relationship networks to human review prior to utilizing the one or more 
generated event relationship networks to construct the one or more correlation rules. 

3 . (Original) The method of claim 1 , wherein, when one or more previously generated event 
relationship networks are available, the step of automatically generating one or more event 
relationship networks comprises: 

obtaining one or more previously generated event relationship networks; 

validating the one or more previously generated event relationship networks by removing 
any nodes or links included therein that are incorrect for a particular application context; 

completing the one or more previously generated event relationship networks by adding any 
nodes or links thereto that are missing for the particular application context; 

outputting the one or more validated and completed event relationship networks as the one 
or more event relationship networks used to construct the one or more correlation rules. 

4. (Original) The method of claim 3, wherein the validating and completing steps utilize a 
statistical correlation analysis. 



3 



Attorney Docket No. YOR920010748US1 

5. (Original) The method of claim 4, wherein the statistical correlation analysis utilizes 
pairwise correlation analysis, wherein correlation between a pair of events is measured in 
accordance with one or more statistical measurements. 

6. (Original) The method of claim 3, wherein the validating step comprises, for a particular 
event relationship network, determining that links in the event relationship network have a 
confidence level not less than a given threshold. 

7. (Original) The method of claim 3, wherein the validating step, for a particular event 
relationship network, comprises: 

splitting the event relationship network into correlation paths; 

for every correlation path, removing a node that has the least number of correlated nodes 
associated therewith until every node is fully correlated with every other node; and 

merging correlation paths into one or more event relationship networks such that every path 
in a resulting event relationship network has every node fiiUy correlated with every other node in 
the path. 

8. (Original) The method of claim 1 , wherein, when one or more previously generated event 
relationship networks are not available, the step of automatically generating one or more event 
relationship networks comprises: 

mining patterns from the event data; 

utilizing the mined patterns to construct the one or more event relationship networks; 
outputting the one or more event relationship networks constructed from the mined patterns 
as the one or more event relationship networks used to construct the one or more correlation rules. 

9. (Original) The method of claim 8, wherein the constructing step utilizes a statistical 
correlation analysis to mine patterns. 
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10. (Original) The method of claim 8, wherein the statistical correlation analysis utilizes 
pairwise correlation analysis, wherein correlation between a pair of events is measured in 
accordance with one or more statistical measurements. 

1 1 . (Original) The method of claim 1 , wherein the event data is obtained from an event log 
representing historical events associated with a particular system being managed by the event 
management system. 

12. (Original) The method of claim 1 , wherein the one or more event relationship networks 
comprise annotations relating to statistical correlation between nodes. 

13. (Original) The method of claim 1, wherein the event data is preprocessed prior to use 
in generating the one or more event relationship networks by removing at least a portion of any 
redundant events. 

14. (Currently Amended) Apparatus use in accordance with an event management system, 
the apparatus comprising: 

at least one processor operative to: (i) automatically generate one or more event relationship 
networks from event data, wherein an event relationship network comprises a graphical 
representation wherein nodes representing events and links connecting correlated nodes; and (ii) 
utilize the one or more generated event relationship networks to construct one or more correlation 
rules for use by a correlation engine in the event management system; and 

memory, coupled to the at least one processor, which stores at least one of the event data and 
the one or more event relationship networks. 

15. (Original) The apparatus of claim 14, wherein the at least one processor is further 
operative to permit the operation of subjecting the one or more generated event relationship 
networks to human review prior to utilizing the one or more generated event relationship networks 
to construct the one or more correlation rules. 
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16. (Original) The apparatus of claim 14, wherein, when one or more previously generated 
event relationship networks are available, the operation of automatically generating one or more 
event relationship networks comprises: 

obtaining one or more previously generated event relationship networks; 

validating the one or more previously generated event relationship networks by removing 
any nodes or links included therein that are incorrect for a particular application context; 

completing the one or more previously generated event relationship networks by adding any 
nodes or links thereto that are missing for the particular application context; 

outputting the one or more validated and completed event relationship networks as the one 
or more event relationship networks used to construct the one or more correlation rules. 

17. (Original) The apparatus of claim 16, wherein the validating and completing operations 
utilize a statistical correlation analysis. 

18. (Original) The apparatus of claim 1 7, wherein the statistical correlation analysis utilizes 
pairwise correlation analysis, wherein correlation between a pair of events is measured in 
accordance with one or more statistical measurements. 

19. (Original) The apparatus of claim 16, wherein the validating operation comprises, for 
a particular event relationship network, determining that links in the event relationship network have 
a confidence level not less than a given threshold. 

20. (Original) The apparatus of claim 16, wherein the validating operation, for a particular 
event relationship network, comprises: 

splitting the event relationship network into correlation paths; 

for every correlation path, removing a node that has the least number of correlated nodes 
associated therewith until every node is fiilly correlated with every other node; and 
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merging correlation paths into one or more event relationship networks such that every path 
in a resulting event relationship network has every node fully correlated with every other node in 
the path. 

2 1 . (Original) The apparatus of claim 14, wherein, when one or more previously generated 
event relationship networks are not available, the step of automatically generating one or more event 
relationship networks comprises: 

mining patterns from the event data; 

utilizing the mined patterns to construct the one or more event relationship networks; 
outputting the one or more event relationship networks constructed from the mined patterns 
as the one or more event relationship networks used to construct the one or more correlation rules. 

22. (Original) The apparatus of claim 21, wherein the constructing operation utilizes a 
statistical correlation analysis to mine patterns. 

23 . (Original) The apparatus of claim 2 1 , wherein the statistical correlation analysis utilizes 
pairwise correlation analysis, wherein correlation between a pair of events is measured in 
accordance with one or more statistical measurements. 

24. (Original) The apparatus of claim 14, wherein the event data is obtained from an event 
log representing historical events associated with a particular system being managed by the event 
management system. 

25. (Original) The apparatus of claim 14, wherein the one or more event relationship 
networks comprise annotations relating to statistical correlation between nodes. 

26. (Original) The apparatus of claim 14, wherein the event data is preprocessed prior to use 
in generating the one or more event relationship networks by removing at least a portion of any 
redundant events. 
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27. (Currently Amended) An article of manufacture for use in accordance with an event 
management system, the article comprising a machine readable medium containing one or more 
programs which when executed implement the steps of: 

automatically generating one or more event relationship networks from event data, wherein 
an event relationship network comprises a graphical representation wherein nodes representing 
events and links connecting correlated nodes; and 

utilizing the one or more generated event relationship networks to construct one or more 
correlation rules for use by a correlation engine in the event management system. 
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